Getting Data In

How to exclude string from being indexed?

mmsbswe
Engager

Hello community,

i want to configure the splunk forwarder to exclude one specific string from being indexed to the splunk index.

In my case i want to exclude all lines like this from being transferred to the indexer:

*[25-Jun-2019 15:31:29 Europe/Berlin] PHP Deprecated:  The "checkDataSubmission" hook will be removed...*

These are my config files:

File: **/opt/splunkforwarder/etc/system/local/inputs.conf**

...
[monitor:///var/log/docker/php-fpm/error.log]
sourcetype=php:fpm:error
crcSalt=
index=php


File: **/opt/splunkforwarder/etc/system/local/props.conf**

[source::/var/log/docker/php-fpm/error.log]
TRANSFORMS-null= setnull


File: **/opt/splunkforwarder/etc/system/local/transforms.conf **

[setnull]
REGEX = .*PHP Deprecated.*
DEST_KEY = queue
FORMAT = nullQueue

I've done the following steps to debug this by myself:
executed:

- *./splunk cmd btool props list --debug*
- *./splunk cmd btool transforms list --debug*

To check if my configuration files was loaded when restarting the splunk service. All my configured lines are displayed by this.

Also i've restarted the splunk forwarder after editing the config.

Every help will be appreciated.

0 Karma
1 Solution

amitm05
Builder

@mmsbswe
Looks like you are trying to do this on the Univ forwarder itself. These would not apply on UF.
You'd require to take these settings of props.conf and transforms.conf onto your indexer.

Thanks!

View solution in original post

0 Karma

amitm05
Builder

@mmsbswe
Looks like you are trying to do this on the Univ forwarder itself. These would not apply on UF.
You'd require to take these settings of props.conf and transforms.conf onto your indexer.

Thanks!

0 Karma

amitm05
Builder

Have you tried this? Let us know.
You can also mention if you have already sorted this out OR Accept this one if it worked. It'll help others. Thanks

0 Karma

mmsbswe
Engager

Thanks for your reply.

Correct, i do this on the universial forwarder. It seems that i have to try it on our indexer.

Edit: Now it works :-).

0 Karma

amitm05
Builder

Glad that it worked out. Cheers !

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...